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A. Background 


A.1 Background 


Goal #1 of the Information Commissioner’s Office (ICO) Information Rights Strategic Plan 2017-21 is 
to “increase the trust the public has in Government, public bodies and the private sector in terms of 
how personal information is used and made available”. In doing so, the aim is also to increase public 
trust through transparency and creating a culture of accountability, both in the digital economy and 
in digital public service delivery. 


It is therefore important for the ICO to gauge and monitor the public’s changing perceptions in this 
area and where possible to use benchmarks from previous research to understand trends. 


The trust and confidence research was last undertaken in June-July 2020. This year’s study took place 
in May 2021. Both this year’s study and last year’s study took place during the Covid-19 pandemic, 
and one of the aims of the 2021 programme was to gauge public opinion on the transfer and use of 
personal health data to public and private sector organisations to further improve treatments or 
health and care services. 


B. Aims & Objectives 


B.1 Overall Objective 
The main aim of this research is: 


“To gauge the general public’s awareness and perceptions of their information rights and 
to monitor any change in people’s trust and confidence in organisations who use their 
personal information. Also, to provide a measure of how the Commissioner/ ICO is 
perceived by the UK public.” 


In more detail, the research aims to: 


e Monitor the differing levels of the public’s trust and confidence in how companies and 
organisations collect, use and store personal information and in doing so assess what drives 
people’s level of trust and confidence. 

e Measure public perceptions about the regulator. 

e Identify individuals’ awareness of their legislative rights and how to exercise them. 

e Understand individuals’ perceptions around handing over personal information in return for 
access to products and services. 
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C. Executive Summary 


Below is asummary of the key findings from the 2021 research. 
Trust & Confidence 


e Following a significant shift to the middle ground in 2020, the public’s trust and confidence in 
companies/organisations storing and using their personal data has remained largely stable in 
2021. Indeed, a larger proportion than in 2020 claim that their trust and confidence has 
remained the same over the past 12 months. 

e Yet half claim to receive more unwanted marketing calls now than they did 12 months ago, 
and there has been an indicative rise in those providing as reasons for low levels of trust and 
confidence perceptions that companies/organisations sell personal information and concerns 
about data being misused. The proportion claiming to have a good understanding of how their 
personal information is used is down slightly, and the proportion agreeing that 
“companies/organisations are open and transparent about how they collect and use personal 
information” and that “current laws and regulations sufficiently protect personal information” 
are significantly lower compared to last year. 

e Trust and confidence in companies/organisations storing and using children’s personal data is 
similarly split to the overall picture, although with a slightly higher proportion having high 
trust and confidence. 

e Asin 2020, levels of trust and confidence with different types of organisations are highest for 
the NHS and local GPs, and lowest for social media companies. However, the proportion of 
those having high trust and confidence in financial services has fallen. 


Accountability 


e The most top-of-mind way the public claim they would get advice and/or information about 
protecting their personal information is by searching online, followed by contacting the 
company in question. When prompted, the public also frequently mention Gov.uk and the 
Citizens Advice Bureau. 

e A large majority of the public believes that companies/organisations — more so than company 
directors — should be held accountable for data breaches. They state that banning companies 
and organisations from sharing personal information with third parties without permission 
and making it a legal requirement to inform customers of data breaches would increase trust 
and confidence. 

e Although still in the minority, there has been significant rises in the proportions who feel a 
regulatory body and the affected individuals should be held responsible. 

e The data protection concern of most importance to the public is “personal information being 
used for scams or fraud”; this is also the concern most likely to prevent the public from using 
a company. 
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Awareness of the regulator and its purposes 


e Amongst those who don’t mention when prompted the ICO as somewhere they would seek 
information, just under a further two in five (37%) have heard of the ICO. 

e Two thirds are aware that the ICO is the regulator for data protection in the UK. 

e A quarter of those in England, Wales and Northern Ireland are aware that the ICO is the 
regulator for freedom of information. One in seven of those in Scotland are aware that the 
ICO is the regulator for freedom of information for UK-wide public authorities based in 
Scotland, and not the Scottish Information Commissioner. 

e While two thirds agree that the regulator is there to act in the interests of the public, there is 
some misunderstanding and confusion about the role, with one in six believing that the public 
cannot contact the regulator. 


Perceptions of legislative rights and how to exercise them 

e There has been an indicative rise in the relative importance of the right to object to personal 
information being processed and a significant decline in the proportion claiming to have 
accessed their personal information. 

e Although most have not exercised or experienced their rights, many are open to doing so in 
the future. However, for those who would consider exercising a right, most are unaware or 
not sure how to do this. 


Perceptions of the exchange of information 


Exchange of personal information 

e The public are often willing to trade personal information for access to products and services. 
However, they are largely against contact from companies as a result of information being 
shared. 


Exchange of health information 


e Half are comfortable with their personal information being shared if it is for medical reasons, 
although one in five are not. 
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D. Methodology and Response Rates 


D.1 Methodology — main sample and regional boost 


Harris Interactive, an independent market research agency, designed and implemented an online 
quantitative self-completion questionnaire using an online UK panel. 


To ensure robust sample sizes for each of the devolved nations, a boost sample was undertaken to 
ensure a minimum number of interviews were achieved in each of Scotland, Wales and Northern 


Ireland. 


D.1.1 Interviews achieved 


2102 online interviews were obtained amongst UK adults between 6" May — 18" May 2021. 


The numbers shown in the tables below are unweighted numbers, so these are the number of 
interviews achieved before the data was weighted to make it nationally representative by age, 


gender and regions. 


Table 1. Number of interviews achieved by gender 


Total % 
Male 953 46% 
Female 1144 54% 
Identify another way 5 0% 
TOTAL 2102 100% 

Table 2. Number of interviews achieved by age 

Total % 
18-24 172 8% 
25-34 331 16% 
35-44 339 16% 
45-54 412 20% 
55-64 368 18% 
65+ 480 22% 
TOTAL 2102 100% 


Table 3. Number of interviews achieved by region 


England 1718 82% 
Scotland 164 8% 
Wales 113 5% 
Northern Ireland 107 5% 

| TOTAL 2102 100% 
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Table 4. Number of interviews achieved by ethnicity classification 


Total % 
Non-BAME 1871 89% 
BAME 206 10% 
Did not disclose 25 1% 
TOTAL 2102 100% 


Table 5. Number of interviews achieved by parental/carer status 


Non-Parent/Carer 1457 69% 
Parent/Carer 645 31% 
TOTAL 2102 100% 


Table 6. Number of interviews achieved by where people live 


Total % 
Suburban 1149 55% 
Urban 480 23% 
Rural 473 22% 
TOTAL | 2102 100% 


D.1.2 Reporting 
The data has been weighted to be nationally representative by age, gender and region. 


Where relevant, comparisons have been made to the 2020 survey. 


D.1.3 Interpreting the results 


This is a trended report documenting differences and similarities between the 2020 and 2021 
results, at a total and sub-group level, including age, parental status, BAME (Black, Asian and 
Minority Ethnic) status and country of residence. 


Where meaningful year-on-year changes have occurred, or exist between sub-groups, these are 
highlighted as significant differences. Significant differences refer to data that is statistically 
significant, i.e. there is statistical evidence that the difference between two figures has not occurred 
by chance to a level of 95% significance level. 
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E. Research Findings 


E.1 Understanding public trust & confidence levels 


The public continues to be split on the trust and confidence it has in companies and organisations 
storing and using their personal information, with similar levels of trust and confidence as in 2020. 


e Just under 3 in 10 (28%) people have high trust and confidence (rating 4-5 out of 5) in 
companies and organisations storing and using their personal information. However, a similar 
proportion (29%) have low trust and confidence (rating 1-2 out of 5). 


Q1. How much trust and confidence do you have in companies and organisations storing and using 
your personal information? 


2020 2021 
NET: Low trust and confidence 28% 29% 
1—None at all 10% 10% 
2 18% 20% 
3 45% 43% 
4 21% 21% 
5 — A great deal 6% 6% 
NET: High Trust and Confidence 27% 28% 


Base: All Adults: 2020 (2150) / 2021 (2102) 


e Males (33%) are significantly more likely to have high trust and confidence in companies and 
organisations storing and using their personal information than females (22%). 

e Parents/carers (37%) are significantly more likely to have high trust and confidence than 
non-parents/carers (23%). 

e Trust and confidence is significantly higher amongst 18-34 year olds (39%) than 35-54 (29%) 
and 55+ year olds (18%). 

e Those living in urban areas (38%) have a significantly higher level of trust and confidence 
than those living in suburban areas (25%) and rural areas (21%). 

e BAME respondents (34%) also have a significantly higher level of trust and confidence than 
non-BAME respondents (27%). 
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Proportions of trust and confidence amongst parents/carers in companies and organisations storing 
and using their child’s / children’s personal information is similarly split to overall levels of trust and 
confidence. However, for children’s personal data there is a slight shift away from the middle and 
into high trust and confidence. 


A third of parents/carers have high trust and confidence (rating 4-5 out of 5) in companies and 
organisations storing and using their child / children’s personal information. 


Q1aa. Thinking about your child/children, how much trust and confidence do you have in 
companies and organisations storing and using their personal information when they are online? 


NET: Low trust and confidence 29% 
1- None at all 11% 
2 18% 
3 34% 
4 23% 
5 — A great deal 10% 
NET: High Trust and Confidence 33% 
Not applicable 3% 
NB: Question not asked in 2020 Base: All Adults who are parents/carers: 2021 (645) 


Differences between sub-groups are similar to overall trust and confidence: 


e Men (42%) are significantly more likely to have high trust and confidence in companies and 
organisations storing / using their child/children’s personal data than women (23%). 

e 18-34 year olds (40%) are significantly more likely to have high trust and confidence than 35- 
54 year olds (30%) or 55+ year olds (21%). 

e Those living in urban areas (46%) are significantly more likely to have high trust and 
confidence than those living in suburban (29%) or rural (19%) areas. 

e BAME respondents (46%) are significantly more likely to have high trust and confidence than 
non-BAME respondents (32%). 
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There has been a slight shift in spontaneous reasons for high trust and confidence since 2020, with 
legislation now most mentioned, followed by trust in policies, security, and good previous experience. 


e Legislation now being the most mentioned reason is due to a slight increase in this (17%, vs. 
15% in 2020), while there has been a slight decrease in those citing good previous experience 


as a reason (12%, down from 15% in 2020). 


Q1a. What is the main reason for the level of trust and confidence you have in companies and 


organisations storing and using your personal information? 
(Most cited reasons amongst those with a high level of trust and confidence) 


Legislation (protected by the law, regulations, Data Protection Act etc.) 15% 17% 
Trust/I trust them/their policies 12% | 13% 
Good (previous) experience (Never had any problems/No experience of data 

breaches/loss etc.) 15% | 12% 
Security (safe, good security systems) 9% 12% 
Companies protect my data (they don’t share/sell my information without my 

consent etc.) 7% 7% 
(I choose/use) Reputable/Well-known companies 6% 6% 
Their reputation is at stake (They care for their reputation, it’s in their own interests 

to protect data, not lose customers etc.) 4% 5% 
New GDPR policy/Companies have to comply to the new GDPR policy 4% 4% 
Other 15% 6% 
None/Nothing/No reason 7% 4% 
Don’t know/Not sure 2% 3% 


All Adults with a high level of trust and confidence in companies and organisations storing and using personal information: 
2020 (583) / 2021 (538) 
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The main reasons given by the public for having a low level of trust and confidence (rating 1-2 out of 
5) in companies and organisations storing and using their personal information are similar to those 
cited in 2020 and are centred around the belief that companies sell personal information to third 


parties, as well as concerns about data misuse, data hacking and data leaks/breaches. 


Qla. What is the main reason for the level of trust and confidence you have in companies and 


organisations storing and using your personal information? 


(Most cited reasons amongst those with a low level of trust and confidence) 
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They sell your personal information (to 3 parties) 18% 20% 
Data hacking 16% 14% 
Concerns about data/information being misused (not sure what they do 

with my data) 12% 14% 
Data leaks/breaches 13% 13% 
They are profit-driven (they use data for their own purposes/interests) 13% 13% 
Concerns about security (Lack of safety/ Security issues/ Poor security 

systems/It’s not (completely) secure) 9% 9% 
Lack of trust/Not trustworthy/I don’t trust anyone 11% 8% 
They share your personal information with 3 parties (without my consent) 7% 6% 
Spam (junk/ unsolicited emails) 5% 6% 
Marketing/Advertising purpose (used in advertising, for targeted 

advertising) 5% 4% 
Other 8% 4% 
Don’t know/Not sure 1% 1% 


All Adults with a low level of trust and confidence in companies and organisations storing and using personal information: 


2020 (600) / 2021 (630) 
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The most commonly cited reason for having a medium level trust and confidence is that it depends on 
the company as some are better/safer than others, followed by data leaks and a belief that companies 


sell personal information to third parties. 


e There has been a significant decrease in the proportion of those mentioning data hacking 


concerns (8%, down from 13% in 2020). 


Q1a. What is the main reason for the level of trust and confidence you have in companies and 


organisations storing and using your personal information? 


(Most cited reasons amongst those with a medium level of trust and confidence) 


Depends on the company (some are better/safer than others etc.) 12% 12% 
Data leaks/breaches 9% 10% 
They sell your personal information (to 3 parties) 9% 10% 
Concerns about data/information being misused (not sure what they do 

with my data) 9% 9% 
Data hacking concerns 13% 8% 
Concerns about security (Lack of safety/ Security issues/ Poor security 

systems/It’s not (completely) secure) 7% 7% 
| remain vigilant/careful (I have my doubts) 6% 6% 
They share your personal information with 3" parties (without my consent) 5% 6% 
Good (previous) experience (Never had any problems/No experience of 

data breaches/loss etc.) 5% 4% 
Other 8% 5% 
Don’t know/Not sure 4% 3% 


All Adults with a medium level of trust and confidence in companies and organisations storing and using personal 
information: 2020 (976) / 2021 (934) 
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For companies and organisations generally, trust and confidence is highest for the NHS, with three in 


four (75%) having high trust and confidence in this organisation. 


On the other end of the scale, trust and confidence is lowest for social media and messaging 
platforms, with 6 in 10 (60%) having low trust and confidence in these. 


Q2a. Generally, how much trust and confidence do you have in the following companies and 
organisations? 


2021 
NET LOW NET HIGH 
TRUST & TRUST & 
CONFIDENCE | CONFIDENCE | 

The NHS 7% 75% 
Your local GP 8% 72% 
The Police 17% 58% 
National Governmental 17% 55% 


departments/ organisations 


Financial services 16% 55% 

Local Government 20% 49% 

Online retailers 24% 37% 

Mobile, broadband, utility providers 27% 34% 

Social media and messaging 60% 15% 

platforms 

NB: This question was not asked in 2020 Base: All Adults: 2021 (2102) 


Males (39%) are significantly more likely than females (35%) to have high trust and confidence 
in online retailers. 

Parents/carers are significantly more likely to have a high level of trust and confidence in 
online retailers; mobile, broadband and utility providers; and social media and messaging 
services than non-parents/carers. 

55+ year olds are significantly more likely to have high trust and confidence in the NHS; their 
local GP; national government departments and organisations; and local government than 18- 
34 year olds or 35-54 year olds. 

18-34 year olds are significantly more likely to have high trust and confidence in online 
retailers; mobile broadband and utility providers; and social media and messaging services 
than 55+ year olds and 35-54 year olds, with 35-54 year olds also significantly more likely than 
55+ year olds to have high trust and confidence in these organisations. 

Those living in rural areas are significantly more likely than those in urban or suburban areas 
to have high trust and confidence in the NHS, their local GP and the Police, whereas those in 
urban areas are significantly more likely than those in suburban or rural areas to have high 
trust and confidence in online retailers; mobile, broadband and utility providers; and social 
media and messaging services. 
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The highest levels of trust and confidence (rating 4-5 out of 5) in different types of companies and 
organisations storing and using personal information continue to be for the NHS, the Police and 
national governmental bodies, and the lowest levels of trust and confidence (rating 1-2 out of 5) 
continue to be for social media companies. 


In terms of confidence in companies and organisations storing and using personal information, trust 
and confidence remains fairly similar, with the exception of financial services, which has seen a 
significant decrease in high trust and confidence between 2020 (56%) and 2021 (52%). 


Q2. How much trust and confidence do you have in the following companies and organisations 
storing and using your personal information? 


2020 2021 
= NETLOW NETHIGH  NETLOW _ NETHIGH 
TRUST & TRUST & TRUST & TRUST & 

CONFIDENCE CONFIDENCE. CONFIDENCE | CONFIDENCE 
The NHS or your local GP 8% 73% | N/A N/A 
The NHS N/A N/A 9% 72% 
Your local GP N/A N/A 9% 71% 
The Police 17% 59% 17% 57% 
National Governmental 18% 57% 16% 55% 
departments/ organisations 
Financial services 16% 56% 17% 52% 
Local Government 20% 51% 17% 51% 
Online retailers 29% 35% 30% 34% 
Mobile, broadband, utility providers 27% 34% 31% 32% 
Social messaging platforms 60% 16% 59% 16% 


Base: All Adults: 2020 (2150) / 2021 (2102) 


e Males and parents/carers are significantly more likely to have high trust and confidence in 
online retailers; mobile, broadband and utility providers; and social messaging platforms, with 
parents/carers also significantly more likely to have high trust and confidence in the Police. 

e Over 55s are significantly more likely to have high trust and confidence in the NHS, their local 
GP and national government departments than under-54s, while 18-34s are significantly more 
likely to have high trust and confidence in mobile, broadband and utility providers, and social 
messaging platforms than over-35s. 

e Those living in urban areas are significantly more likely than those living in suburban or rural 
areas to have high trust and confidence in online retailers; mobile, broadband and utility 
providers; and social messaging platforms. 

e Non-BAME respondents are significantly more likely than BAME respondents to have high 
trust and confidence in their local GP, the Police, and financial services. 

o BAME respondents are significantly more likely than non-BAME respondents to have 
high trust and confidence in social messaging platforms. 
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The majority (68%) of the public perceive that their trust and confidence in companies and 
organisations storing and using personal information has stayed the same in the past year, a significant 
increase from 2020 (65%). 


e 9% feel that their trust and confidence has increased, a significant fall from 11% in 2020, 
whereas 23% state that it has decreased. 


Q2aa. Has your trust and confidence in companies and organisations storing and using your personal 
information increased, decreased or stayed the same in the past year? 


2021 


E Increased Stayed the same W Decreased 


Base: All Adults: 2020 (2150) 2021 (2102) 


e Males (12%) are significantly more likely to feel that their trust and confidence has increased 
in the last year compared with females (6%). 

e 18-34 year olds (18%) are significantly more likely to feel that their trust and confidence has 
increased in the last year than 35-54 year olds (8%) and 55+ year olds (2%). 

e Parents/carers (16%) are significantly more likely to feel that their trust and confidence has 
increased in the last year than non-parents/carers (5%). 

e Those living in urban areas (18%) are significantly more likely to feel that their trust and 
confidence has increased in the last year than those living in suburban (6%) or rural areas (3%). 

e BAME respondents (17%) are significantly more likely to feel that their trust and confidence 
has increased in the last year compared with non-BAME respondents (8%). 
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The reasons for increased trust in companies and organisations storing and using personal 
information in the past year focus around perceptions of improvements or already good security — 
either feeling that companies and organisations are already satisfactory/improving, or that security 
and security systems are getting better — and not having had any problems. 


A small minority (7%) cite the Covid-19 pandemic as a reason. 


Q2aa1. Why do you say that your trust and confidence in companies and organisations storing and 
using your personal information has increased in the past year? [Most cited reasons for increased trust] 


| 2021 


12% 


| me 
NB: Question not asked in 2020 Base: All who stated their trust and confidence has increased: 2021 (182) 


Conversely, those who said that their trust and confidence had decreased in the past year most 
commonly claimed this was caused by negative stories or reports in the media, followed by a 
perception of too many scams/fraudulent activity. 


Q2aa1. Why do you say that your trust and confidence in companies and organisations storing and 
using your personal information has decreased in the past year?[Most cited reasons for decreased trust] 


NB: Question not asked in 2020 Base: All who stated their trust and confidence has decreased: 2021 (489) 
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69% of parents/carers state that their trust and confidence in companies and organisations storing 
and using their child’s/children’s personal information had stayed the same in the past year, 
although 19% said it decreased. 


Q2aaa. Has your trust and confidence in companies and organisations storing and using your 
child’s/children’s personal information increased, decreased or stayed the same in the past year? 


m increased m Decreased m Stayed the same 


NB: Question not asked in 2020 Base: All Adults who parents/carers: 2021 (656) 


e Males (16%) are significantly more likely to say their trust and confidence in companies and 
organisations handling their children’s personal data has increased in the past year than 
females (8%). 

e 18-34 year olds (21%) are significantly more likely to feel that their trust and confidence has 
increased in the last year than 35-54 year olds (8%) and 55+ year olds (7%). 

e Those living in urban areas (22%) are significantly more likely to feel that their trust and 
confidence has increased in the last year than those living in suburban (8%) or rural areas (4%). 
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Almost three tenths (29%) of those who claim their trust and confidence in companies and 
organisations storing and using their child’s/children’s personal information has increased in the past 
year, state this is because they have not had any issues and are satisfied overall. The second most 
popular reason cited is perceived better security/stricter rules/GDPR regulations. 


Q2aaa1. Why do you say that your trust and confidence in companies and organisations storing and 
using your child/children’s personal information has increased in the past year? 
[Most cited reasons for increased trust] 


NB: Question not asked in 2020 
Base: All who stated their trust and confidence in companies/organisations storing/using their child/children’s personal 
data has increased: 2021 (81) 


The most commonly cited reasons for decreased trust and confidence in companies and 
organisations storing and using children’s personal data are data leaks/breaches and 
hacking/scamming, both mentioned by one in ten (10%). 


Q2aaa1. Why do you say that your trust and confidence in companies and organisations storing and 
using your child/children’s personal information has decreased in the past year? 
[Most cited reasons for decreased trust] 


NB: Question not asked in 2020 
Base: All who stated their trust and confidence in companies/organisations storing/using their child/children’s personal 
information has decreased: 2021 (123) 
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Levels of understanding of how personal information is used by companies and organisations remain 


at similar levels to 2020. 13% of adults feel they have a good understanding of how their personal 
information is used by companies and organisations in the UK. This is slightly lower than the 15% 


who felt they had a good understanding in 2020. 


Q3. Which of the following statements comes closest to your understanding of how your personal 
information is being used by companies and organisations in the UK? 


information is used 


| have a good understanding of how my personal 15% 13% 
information is used 

| am familiar with some aspects of how my personal 54% 54% 
information is used, but not all aspects 

| know very little about how my personal 27% 28% 
information is used 

| know nothing at all about how my personal 4% 5% 


Base: All Adults: 2020 (2150) / 2021 (2102) 


e Males (16%) are significantly more likely to feel they have a good understanding of how 


their personal information is used than females (11%). 


e Parents/carers (19%) are significantly more likely to feel they have a good understanding 


of how their personal information is used than non-parents/carers (11%). 


e Respondents from urban areas (21%) are significantly more likely to feel they have a good 


understanding of how their personal information is used than respondents from suburban 


(11%) or rural areas (11%). 


e 18-34 year olds (21%) are significantly more likely to feel they have a good understanding 


of how their personal information is used than 35-54 year olds (13%) or 55+ year olds 


(8%). 
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12% of adults feel that they have a good understanding of how their personal information is made 
available by third parties and the public by companies and organisations in the UK. This is down slightly 
from 13% in 2020. 


e 42% feel they know very little or nothing at all about how their personal information is made 
available by companies and organisations in the UK. 


Q4. Which of the following statements comes closest to your understanding about how companies 
and organisations in the UK share your personal information with third parties, for example other 
companies and organisations? 


| have a good understanding of how my personal 13% 12% 
information is made available 


| am familiar with some aspects of how my personal 46% 46% 
information is made available, but not all aspects 


| know very little about how my personal information 33% 35% 
is made available 


| know nothing at all about how my personal 8% 7% 
information is made available 


Base: All Adults: 2020 (2150) / 2021 (2102) 


e Males (15%) are significantly more likely to feel they have a good understanding of how their 
personal information is made available than females (9%), whereas females are significantly 
more likely to feel that they know very little about how their personal information is made 
available than males (38% vs 35% respectively). 

e Parents/carers (18%) are significantly more likely to feel they have a good understanding of 
how their personal information is made available than non-parents/carers (9%), whereas non- 
parents/carers are significantly more likely to feel they know very little about how their 
personal information is made available than parents/carers (39% vs 28% respectively). 

e Respondents from urban areas (20%) are significantly more likely to feel they have a good 
understanding of how their personal information is made available than respondents from 
suburban (9%) or rural areas (8%). 
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There has been a notable negative shift in responses to certain statements about the use of personal 
information, with agreement that “Current laws and regulations sufficiently protect personal 
information” falling significantly from 49% in 2020 to 42% in 2021. 
e The proportion of the public that agrees that “companies/organisations are open and 
transparent about how they collect and use personal information” has also decreased 
significantly since 2020 (33% compared to 37%). 


Q5. Do you agree or disagree with the following statements about the use of personal information in 
the UK? 


2020 2021 


NET | NET Don’t NET NET Dont 
Agree | Disagree know Agree Disagree know 


Current laws and regulations sufficiently 49% 41% 11% 42% 45% 13% 
protect personal information 
It is easy to access and change my 40% 45% 15% 40% 44% 16% 


personal information held by 
companies/organisations 
Companies/organisations are open and 37% 54% 9% 33% 56% 10% 
transparent about how they collect and 
use personal information 


It is easy to find out how my personal 31% 55% 13% 30% 56% 14% 
information is stored and used by 
companies/ organisations 


It is easy to find out whether my personal | 29% 58% 13% 26% 59% 15% 
information is shared with third parties 


Base: All Adults: 2020 (2150) / 2021 (2102) 


e Parents/carers, 18-34 year olds, BAME respondents, and those living in urban areas are 
significantly more likely to agree with all of the statements than non-parents/carers, 35+ 
year olds, non-BAME respondents, and those living in suburban or rural areas. 
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Half (50%) of the public state that they or a close friend/family member have heard about or actually 
experienced a data breach (i.e. personal information being shared without permission, used 
fraudulently or lost/stolen) in the last 12 months, a decrease from 57% in 2020. 


e There has been a significant drop amongst those who say that either they or a close 
friend/family member “heard a news story about a data breach in a company/organisation 
that they have shared personal information with, but were not personally notified”, from 31% 
in 2020 to 25% in 2021. 


Q7i & Q7ii. Thinking about personal information you may hold with companies and organisations, 
have any of the following things happened to you or a close friend/family member in the last 12 


months? 
2020 2021 
Happened Happened NET Happened Happened NET 
to you toa Happened] to you toa Happened 
friend/ | to you/ friend/ | to you/ 
family | friend or family | friend or 
member | family member | family 
Net: ANY 51% 36% 57% 45% 35% 50% 
Heard a news story about a data breach ina 26% 12% 31% 22% 11% 25% 


company/ organisation that I/they have shared 
personal information with, but was not personally 


notified 

Personal information has been shared with a third 15% 9% 20% 15% 9% 18% 
party without permission 

Had an online account(s) accessed or used 12% 13% 22% 10% 13% 19% 
fraudulently by someone else 

Had personal details stolen and used to commit 8% 11% 16% 6% 10% 13% 
fraud 

Been told by a company or organisation I/they’ve 15% 9% 19% 13% 9% 17% 


contacted/ hold an account with or are employed 

by, that my/their personal details may have been 

lost or stolen 

None of these 49% 64% 43% 55% 65% 50% 
Base: All Adults: 2020 (2150) / 2021 (2102) 
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Around one in ten (9%) feel that they (5%) or a close friend / family member (5%) have been negatively 
affected as a result of a company or organisation not sharing their data. Some cite examples of finding 
it hard to have data transferred between companies even when they have requested it or require it, 
which can be frustrating. Interestingly, a few mention that either they or a close friend/family member 
has had a negative experience with medical care due to improper communication or medical data 
being shared between providers. 


Q7icom/Q7iicom. Please tell us why you/a friend/family member has been negatively affected as a 
result of a company or organisation NOT sharing their data in the last 12 months? 


2021 
Happened Happened to a friend/ NET Happened to 


to you family member you/ friend or family 


Been negatively affected as a result of an 
organisation NOT sharing data 


Base: All Adults: 2021 (2102) 


Example comments around how “you” have been negatively affected 


“lm unsure exactly, | just know that | “Because when it should have been 
wasn’t offered a suitable product shared - medical stuff - it wasn't so | 
recently as a result of this” became il 


|’ 


“Needing information shared that | 
wanted between companies. Impossible 
to get this done” 


“My bank account was NOT transferred 
when | instructed” 


Example comments around how “a friend/family member” has been negatively affected 


“An organisation was reluctant to share “Because my family member needed 
old working data and was therefore some medical documents and they were 
affected at her new job by it” not given” 


“Important information was not passed 
on as it should have been” 


This question was not asked in 2020 
Base: All Adults who have been affected by personal data NOT being shared (either themselves or a close friend / family 
member): (183) 
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Over three quarters (77%) of the public state that protecting their personal information is important 
to them; however, it also appears that people sometimes struggle to control the use of their 


information, as... 


e A third (33%) disagree that “I am confident | know who to seek help from about my rights 
and companies/organisations storing and using my personal information” and that 


“Companies/organisations usually make it easy for me to change how much of my personal 


information they have access to”. 


e Half (50%) agree that they receive more unwanted marketing calls than they did 12 months 


ago. 


Q8a. Thinking generally about the overall trust and confidence that you have in companies and 
organisations storing and using your personal information, please tell us how much you agree or 


disagree with the following. 


NET Agree Neither Agree 


Nor Disagree Disagree 


| 


Protecting my personal information is essential to me 77% 18% 5% 
| know now to opt-out of receiving online communications from 60% 25% 15% 
companies/organisations 

The amount of trust | have in a company/organisation handling my personal 

A eas 58% 33% 9% 
information is linked closely to how much | trust them generally 

Covid-19 has made me more digitally active 57% 28% 15% 
As far as I’m aware, my personal details are shared between 53% 37% 10% 
companies/organisations 

If eons service is free to use | accept that | may be ‘paying’ for it by 53% 32% 15% 
providing my personal information 

| receive more unwanted marketing calls than | did 12 months ago 50% 26% 24% 
| understand current laws around the use of my personal information 39% 34% 27% 
| understand how companies/organisations use my personal information 35% 35% 30% 
lam confident | now who to SEEK help from about my rights and 34% 33% 33% 
companies/organisations storing and using my personal information 

a of companies/organisations misusing my personal 30% 33% 37% 
Companies/organisations usually make it easy for me to change how much of 29% 39% 33% 
my personal information they have access to 


NB: This question was not asked in 2020 


Base: All Adults: (2102) 


There are a considerable number of differences by sub-groups to these statements: 


e Females are significantly more likely than males to agree that “Protecting my personal 


information is essential to me”, “The amount of trust | have in a company/organisation 


handling my personal information is linked closely to how much | trust them generally”, and 


“Covid-19 has made me more digitally active”. 
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o Males, on the other hand, claim more digital ‘savviness’, being significantly more 
likely than females to agree that “If an online service is free to use | accept that | 
may be 'paying' for it by providing my personal information”, “I am confident | know 
who to seek help from about my rights and companies/organisations storing and 
using my personal information”, and “Companies/organisations usually make it easy 
for me to change how much of my personal information they have access to”. They 
are, however, also significantly more likely to agree “I’ve had experiences of 
companies/organisations misusing my personal information”. 


e Parents/carers are significantly more likely than non-parents/carers to agree that... 
o “Covid-19 has made me more digitally active” 


o “l understand how companies/organisations use my personal information” 
o “I've had experiences of companies/organisations misusing my personal 
information” 


o “Companies/organisations usually make it easy for me to change how much of my 
personal information they have access to”. 


e Those aged 55+ are significantly more likely to agree that “Protecting my personal 
information is essential to me” than those aged 18-34 or 35-54. 


e Those aged 18-34 are more likely than over 35s to agree that... 
o “l understand how companies/organisations use my personal information” 
o “lam confident | know who to seek help from about my rights and 
companies/organisations storing and using my personal information”. 


e BAME respondents are more likely than non-BAME respondents to agree that... 


o “lam confident | know who to seek help from about my rights and 
companies/organisations storing and using my personal information” 

o “I’ve had experiences of companies/organisations misusing my personal 
information” 


o “Companies/organisations usually make it easy for me to change how much of my 
personal information they have access to” 
“I understand current laws around the use of my personal information”. 
“Covid-19 has made me more digitally active”. 


e Those living in urban areas are significantly more likely than those living in suburban or rural 
areas to agree that.... 


o “l understand how companies/organisations use my personal information” 

o “lam confident | know who to seek help from about my rights and 
companies/organisations storing and using my personal information” 

o “I've had experiences of companies/organisations misusing my personal 
information” 

o “l understand current laws around the use of my personal information”. 
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Almost three quarters (74%) feel that if a company/organisation that they used was affected by a 
data breach and their information was lost or stolen, the company holding the data should be held 


responsible. 


Two fifths (40%) of the public feel that the culpability should rest with the directors of the 
company/organisation holding their personal information. 

Interestingly, there have been significant increases year-on-year in the proportion who feel a 
regulatory body should be held responsible (20%, vs. 17% in 2020) and the proportion who 
feel the individual affected should be held responsible (15%, vs. 9% in 2020). 


Q8. If a company/organisation that you used was affected by a data breach and your information 
was lost or stolen, who do you think should be held responsible? 


The company/ organisation who was holding my personal 73% 74% 
information 

The directors of the company/organisation holding my personal 39% 40% 
information 

A regulatory body 17% 20% 
The Government 11% 13% 
Me* 9% 15% 
Don’t Know 5% 5% 
None 2% 1% 
Other 1% 1% 


* option was presented as “You” in 2020 
Base: All Adults: 2020 (2150) / 2021 (2102) 


Females (78%) are significantly more likely to state that the company/organisation holding 
the personal information should be held responsible than males (71%). 

o Males, on the other hand, are significantly more likely to state that a regulatory body, 
the individual affected, and Government (22%, 18% and 16% respectively) should be 
held responsible than females (17%, 13% and 10% respectively). 

Non-parents/carers (79%) are significantly more likely to state that the company/organisation 
that was holding the personal information should be held responsible than parents/carers 
(64%). 

o Parents/carers, on the other hand, are significantly more likely to state that a 
regulatory body (25%), the individual affected (22%), and Government (19%) should 
be held responsible than non-parents/carers (17%, 12%, and 10% respectively). 

55+ year olds (84%) are significantly more likely to state that the company/organisation 
holding their data should be held responsible than 35-54 year olds (74%) and 18-34 year olds 
(62%). They are also significantly more likely to state that the directors of the 
company/organisation should be held responsible (46%) than 35-54 year olds (40%) and 18- 


34 year olds (30%). 
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18-34 year olds were significantly more likely to state that if a data breach occurs, a regulatory 
body (26%), the individual affected (23%), or Government (23%) should be held responsible 
than 35-54 year olds (19%, 14% and 13% respectively) and 55+ year olds (15%, 11% and 6% 
respectively). 

Non-BAME respondents are significantly more likely to state that if a data breach occurs, the 
company/organisation that was holding the data should be held responsible (75%) than BAME 
respondents (66%). 

o On the other hand, BAME respondents are significantly more likely to state that a 
regulatory body (30%), the individual affected (22%), or Government (23%) should be 
held responsible than non-BAME respondents (18%, 14%, and 12% respectively). 

Those living in urban areas are significantly more likely to state that a regulatory body (26%), 
the individual affected (24%), or the Government (25%) should be held responsible than those 
in suburban (17%, 13% and 9% respectively) and rural areas (17%, 10% and 8% respectively). 
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People are most likely to state that either “banning companies/organisations from sharing personal 

information with third parties without permission” or “making it a legal requirement for 

companies/organisations to tell customers that they have been affected by a data breach” would 

increase their trust and confidence in how their personal information is used and made available. 

These are ranked first of six options by 24% and 22% respectively and in the top three by 62% and 

61% respectively. These findings are very consistent with those from 2020. 

e The public is least likely to state that “companies/organisations having to register with the UK 

body that upholds the public’s information rights” would increase trust and confidence in how 
personal information is used and made available. This is ranked first by one in ten (11%). 


Q9. Which of the following, if any, would increase your trust and confidence in how your personal 
information is used and made available by companies and organisations? 


2020 2021 


1*Choice  NET:Top3 1" Choice.  NET:Top3 | 


Ban companies/organisations from 
sharing personal information with third 24% 62% 24% 62% 
parties without permission 


Make it a legal requirement for 
companies/organisations to tell 


239 29 229 19 
customers that they have been affected a7 62% k oy 
by a data breach 
Give custodial sentences (i.e. prison) for 
those responsible for the most severe 17% 46% 15% 42% 


breaches in the use of personal 
information 


Fine companies and organisations if 
they are found to use personal 15% 58% 15% 56% 
information without permission 


Make it easier to see and change any 
consent | have given to companies/ 
organisations regarding the use of my 
personal information 


11% 40% 12% 43% 


Register companies/organisations with 
the UK body that upholds the public’s 10% 34% 11% 36% 
information rights 


Base: All Adults: 2020 (2150) / 2021 (2102) 


e Non-parents/carers are significantly more likely to rank first banning companies/organisations 
from sharing personal information with third parties without permission (27%) than 
parents/carers (19%). 

e Those aged 55+ are significantly more likely to rank first banning companies/organisations 
from sharing personal information with third parties without permission (29%) than 35-54 
year olds (22%) and 18-34 year olds (21%). 
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E.2 Public knowledge/awareness of the regulator of data protection 


Unprompted, the largest proportion of the public states that if they wanted to get advice and/or 
information on protecting their personal information, they would search online, mentioned by more 


than three in ten (32%). 


e One in ten (10%) would seek advice from the Citizens Advice Bureau, slightly up from 7% in 
2020. 

e However, knowing where to source advice and/or information on protecting personal 
information remains an area of uncertainty for many, with one in six (17%) of the public stating 
they are unsure. This is down slightly on the 19% stating this in 2020. 


Q13a. What would you do if you wanted to get advice and/or information on protecting your 
personal information? (UNPROMPTED) 
(Most cited reasons) 


Search online 31% 32% 
Contact the company in question 17% 16% 
Contact Citizens Advice Bureau/CAB (for advice) 7% 10% 
Look on/seek help on Government websites (gov.uk) 4% 4% 
Contact a solicitor/lawyer/seek legal advice 2% 2% 
Ask/search for information/seek advice (generic) 2% 4% 
Contact the Government/Government bodies 2% 2% 
Contact the Information Commissioner's Office (ICO) (website) 2% 2% 
Other 6% 4% 
Don't know/Not sure 19% 17% 


Base: All Adults: 2020 (2150) / 2021 (2102) 
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When prompted, the most common way that the public would look to get advice and/or 
information on protecting their personal information is via a search engine, mentioned by just 
over half (52%). 


e Other key ways that would be used to get advice and/or information are via Gov.uk (48%) and 


the Citizens Advice Bureau (41%). 22% would seek advice from the ICO. 
e Friends and family would be a source of information for 25%. 


Q13. Where would you go to get advice and/or information on protecting your personal 


information? (PROMPTED) 


Search Engine 

Gov.Uk 

Citizens Advice Bureau 

Friends & family 

Information Commissioner's Office 


Other consumer advice organisations (excuding CAB) 


N a2 
a 48% 
a 41% 
25% 

ee 22% 

es 20% 


Wikipedia EE 38% 


Local MP SE 8% 


Other EN 7% 


Don'tknow [ff 1% 


| wouldn't look for advice J 1% 


NB: This question was not asked in 2020 Base: All Adults: (2102) 


e Females (30%) are significantly more likely to look to friends and family for advice and/or 
information on protecting their personal information than males (19%). 

e 18-34 year olds (35%) are significantly more likely to look to friends and family for advice 
and/or information than 35-54 year olds (20%) and 55+ year olds (21%). 

e BAME respondents are significantly more likely to seek information via Gov.uk (57%), friends 
and family (35%) and their local MP (15%) than non-BAME respondents (47%, 23% and 7% 
respectively). 
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Amongst those who don’t mention when prompted the ICO as somewhere they would seek 
information, just under a further two in five (37%) people have heard of the ICO. 


Q13c. Have you ever heard of the Information Commissioner’s Office (ICO)? 


Yes 37% 
No 54% 
Unsure 9% 
NB: This question was not asked in 2020 Base: All Adults: (2102) 


Males (43%) are significantly more likely to be aware of the ICO than females (31%). 
Parents/carers(41%) are significantly more likely to be aware of the ICO than non- 
parents/carers (35%). 

35-54 year olds (40%) are significantly more likely to be aware of the ICO than 18-34 year olds 
(34%) or 55+ year olds (35%). 

Those living in urban areas (41%) are significantly more likely to be aware of the ICO than 
those living in suburban (36%) and rural (34%) areas. 
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When prompted, two thirds (66%) of those aware of the ICO are aware that it is the regulator for data 
protection in the UK, with no change on the 2020 proportions. 


Q13d. The Information Commissioner’s Office (ICO) is the regulator for data protection in the UK. 
Were you aware of this before today? 


2021 66% 23% 11% 


2020 23% 11% 


Yes No Don't Know 


Base: All Adults aware of the ICO: 2020 (937) / 2021 (771) 


e Males (73%) are significantly more likely to be aware that the ICO is the regulator for data 
protection in the UK than females (57%). 

e 35-54 year olds (72%) are significantly more likely to be aware that the ICO is the regulator for 
data protection in the UK than 55+ year olds (61%). 
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A quarter (25%) of those from England, Wales or Northern Ireland are aware that the ICO is the 
regulator for freedom of information in these countries. 


Q14b1. The Information Commissioner's Office (ICO) is the regulator for freedom of information in 
England, Wales and Northern Ireland. Were you aware of this before today? 


= Yes m No m Unsure 


NB: This question was not asked in 2020 Base: All Adults from England, Wales or Northern Ireland: (1927) 


e Males (31%) are significantly more likely to be aware that the ICO is the regulator for freedom 
of information in England, Wales and Northern Ireland than females (20%). 

e Parents/carers (31%) are significantly more likely to be aware that the ICO is the regulator for 
freedom of information in England, Wales and Northern Ireland than non-parents/carers 
(23%). 

e Those aged 18-34 (28%) or 35-54 (28%) are significantly more likely to be aware that the ICO 
is the regulator for freedom of information in England, Wales and Northern Ireland than those 
aged 55+ (21%). 

e Those living in urban areas (33%) are significantly more likely to be aware that the ICO is the 
regulator for freedom of information in England, Wales and Northern Ireland than those who 
live in suburban or rural areas (both 23%). 
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One in seven (14%) of those living in Scotland are aware that the ICO is the regulator for freedom of 
information for UK-wide public authorities based in Scotland, and not the Scottish Information 
Commissioner. 


Q14b2. The Information Commissioner's Office (ICO) is the regulator for freedom of information for 
UK-wide public authorities based in Scotland, and not the Scottish Information Commissioner. Were 
you aware of this before today? 


m Yes m No m Unsure 


NB: This question was not asked in 2020 Base: All Adults from Scotland: (175) 


e Males (22%) are significantly more likely than females (5%) to be aware that the ICO is the 
regulator for freedom of information for UK-wide public authorities based in Scotland. 
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Two thirds (66%) of adults believe that the “regulator is there to act for the interests of the public”, 
and nearly three in five (57%) agree the “regulator can successfully enforce data protection through 
the courts”. 


e However, one in six (16%) state “the public cannot contact the regulator” and a further one in 
five (21%) state “the regulator will only deal with data breaches from large companies”, 
enforcing the need to ensure the ICO’s purposes continue to be made public. 

e Furthermore, there is often uncertainty around the purposes of the regulator of data 
protection, with between 24% - 48% of adults stating they don’t know if the purposes actually 
apply. 


Q13bb. From the following list, please say whether you think these apply to the regulator of data 
protection in the UK. We are looking for your initial thoughts regardless of whether they are right or 
wrong. 


The regulator is there to act for the interests of 69% 9% 22% 66% 10% 24% 
the public 

The regulator can successfully enforce data 60% 9% 31% 57% 11% 32% 
protection through the courts 

The regulator has the power to impose a 57% 9% 34% 53% 12% 35% 
monetary penalty on a company 

The regulator can audit any company, at any time 54% 10% 36% 52% 11% 37% 
The regulator is a governmental department 45% 18% 36% 41% 19% 40% 
The regulator supports organisations to use 30% 21% 49% 29% 22% 48% 
personal information in innovative ways 

The regulator will only deal with data breaches 21% 44% 35% 21% 44% 35% 
from large companies 

The public cannot contact the regulator 17% 41% 42% 16% 40% 44% 


Base: All Adults: 2020 (2150) / 2021 (2102) 


e Males are significantly more likely to believe that the regulator will only deal with data 
breaches from large companies (24%) and that the public cannot contact the regulator (18%) 
than females (18% and 14% respectively). 
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E.3 Legislative rights and concerns 
E.3.1 Personal Information 


When considering the personal information held by companies and organisations in the UK, the right 
the public deem of most importance is the “right to access my personal information”, ranked first of 
eight options by 20% and in the top three by 49%. 


e Around one in six (16%) state that the personal information right of most importance to them 
is the “right to be informed about the collection and use of my personal information” with 
45% ranking it in the top three rights. 

e “The right to restrict the processing of my personal information” is also important for many, 
with around one in seven (14%) ranking it first of eight options and in the top three by 44%, 
although those ranking it in the top three has seen a decrease from just under half (48%) in 
2020. 

e The “right to move personal information from one provider to another” is the least important 
right, with only one in twenty (5%) ranking it first of eight options and in the top three by 20%. 


Q12a. For the personal information held about you by companies and organisations in the UK, which 
of the following rights are the most important to you? 


a choice  NET:Top3 1“ Choice NET: Top3_ 


The right to access my personal 


information 19% 49% 20% 49% 
The right to be informed about the 

collection and use of my personal 16% 43% 16% 45% 
information 

The right to restrict the processing of 

my personal information 16% 48% 14% 44% 
The right to be forgotten / to have 

personal information erased 15% 39% 14% 39% 
The right to object to personal 

information being processed 13% 42% 15% 45% 


The right to have inaccurate personal 
information rectified, or completed if it 9% 31% 8% 30% 
is incomplete 


The right not to be the subject of 
automated decision making and 8% 29% 8% 29% 
profiling 


The right to move personal information 
from one provider to another 5% 18% 5% 20% 


Base: All Adults: 2020 (2150) / 2021 (2102) 


36 


©2021, Harris Interactive All rights reserved 


Information Commissioner’s Office 
Information Rights Strategic Plan: Trust and Confidence 


The proportion of the public that claims to have exercised or experienced each personal information 
protection right is relatively low. However, many are open to doing so in the future. 


e “Being informed about the collection and use of my personal information” is the right with 
the highest proportion of the public having already done or experienced this (18%). 

e The proportion stating they have already accessed their personal information has seen a 
decline from 18% in 2020 to 12%. 

e Between 49% - 64% either want to do or experience each right but have not yet or would 
consider doing or experiencing it in the future. 

e = The right with the lowest proportion being open to doing it in the future is “moving my 
information from one provider to another” (49%) which is also the right with the largest 
proportion feeling they don’t know anything about it (43%). 


Q12b. Again, looking at the following personal information protection rights, which of the following 
best describes you on each? 


2020 2021 


Have NET plan NET don’t) Have NET plan (NET don’t 
already to know already ive) know 
done this consider /| anything | done this consider / anything 


experience about this experience about this 
this protection this protection 
right / right / 
Unsure Unsure 


Being informed about the collection and 
use of my personal information 20% 58% 22% 18% 57% 24% 


Accessing your personal information 


18% 59% 24% 12% 64% 24% 
Restricting the processing of my 
personal information 13% 62% 25% 12% 61% 26% 
Objecting to personal information being 
processed 

11% 64% 25% 11% 62% 27% 


Having inaccurate personal information 
rectified, or completed if it is incomplete} 11% 60% 29% 10% 60% 30% 


Requesting to be ‘forgotten’ / have 
personal information erased 


11% 60% 29% 11% 59% 30% 
Moving my information from one 
provider to another 7% 48% 45% 8% 49% 43% 
Not being the subject of automated 
decision making and profiling 
7% 54% 38% 7% 56% 37% 
37 


©2021, Harris Interactive All rights reserved 


Information Commissioner’s Office 
Information Rights Strategic Plan: Trust and Confidence 


Base: All Adults: 2020 (2150) / 2021 (2102) 
e With the exception of “being informed about the collection and use of my personal 


information”, parents/carers are significantly more likely to have already exercised personal 
data protection rights than non-parents. 

e With the exception of “being informed about the collection and use of my personal 
information” and “accessing the personal information held about me by a 
company/organisation”, those aged 55+ are significantly more likely to say they don’t know 
anything about a data right than 35-54 year olds and 18-34 year olds. 

e BAME respondents are significantly more likely to have already requested to be forgotten, 
have inaccurate personal information rectified or completed, and moved their information 
from one provider to another than non-BAME respondents. 

e Those living in urban areas are significantly more likely to have already exercised all data 
rights than those living in suburban or rural areas. 
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Of those who would consider exercising their data protection rights in the future, there are varying 
levels of awareness of how to actually do it, with the majority of the public either not aware or 
unsure. 


e Under two in five (39%) of those who want to or would consider “accessing their personal 
information” are aware how to do so, although this is up slightly on the proportion stating this 
in 2020 (36%). 

e This falls to just over a quarter (26%) of those who want to or would consider “not being the 
subject of automated decision making” being aware how to do so. 


Q12c. You mentioned you want to or would consider doing the following in the future. Would you 
say you are aware of how to do each of these? 


Accessing your personal information 36% 44% 20% 39% 38% 23% 


Being informed about the collection and 


use of my personal information 33% 47% 19% 32% 47% 22% 
Having inaccurate personal information 

rectified, or completed if itis incomplete} 30% 50% 21% 30% 47% 23% 
Restricting the processing of my 

personal information 29% 51% 20% 30% 45% 25% 


Objecting to personal information being 
processed 31% 51% 18% 29% 45% 25% 


Requesting to be ‘forgotten’ / have 
personal information erased 32% 50% 18% 28% 48% 24% 


Moving my information from one 
provider to another 29% 48% 22% 27% 48% 25% 


Not being the subject of automated 
decision making and profiling 24% 56% 20% 26% 49% 25% 


Base: All Adults who would consider doing/experiencing the personal information rights: 2020 (ranging from 1034 to 1356) 
/ 2021 (ranging from 1034 to 1334) 


e Males are significantly more likely to claim they know how to “move my information from 
one provider to another” and “not be the subject of automated decision making and 
profiling” than females. 

e  Parents/carers are significantly more likely to claim they know how to exercise all of the 
rights than non-parents/carers. 
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Unprompted, the overriding concerns stated by the public are that their data could be sold/shared 
with third parties (21%) and being a victim of fraud/scams (16%). 


e Having data shared/sold to third parties and being a victim of fraud/scams are the main 
concerns for those with low, medium or high levels of confidence in companies and 
organisations storing/using personal information. 

e Those with high levels of trust and confidence are much more likely to say that have no 
concerns about the protection of their personal information (18%) than those with medium 
or low levels of trust and confidence (7% and 4% respectively). 


Q14a. Thinking about the protection of your personal information, what would you say are your 
concerns? (UNPROMPTED) 


2020 2021 


Total Low trust Medium High trust Total Low trust | Medium High trust 
& trust & and & trust & and 
confidenceconfidenceconfidence confidenceconfidenceconfidence 
‘(toy 0)) (ELTA) (ELE) (E) (909) (EYA) 


Having my data 
shared/passed on to 


3rd parties/sold to 
others 20% 22% 22% 15% 21% 23% 22% 18% 


Being the victim of 


fraud/scams (no 
mention of identity) | 18% 20% 19% 14% 16% 18% 18% 12% 


Misuse of my data 
(including by 3rd 
parties) 9% 13% 9% 6% 11% 12% 12% 9% 


Identity theft/fraud 10% 12% 10% 6% 10% 11% 10% 8% 


Bank details (might 
get stolen)/Access to 


my bank account/ 
credit cards 7% 5% 8% 9% 8% 7% 8% 7% 


Being hacked/Having 
my computer/ 


accounts hacked 8% 7% 10% 7% 7% 6% 8% 7% 
Other 7% 9% 6% 6% 5% 7% 4% 3% 
Nothing 10% 4% 6% 22% 9% 4% 7% 18% 


All Adults: 2020 (2150) / 2021 (2102). 
e Males (13%) are significantly more likely to say they have no concerns than females (6%). 
e Parents/carers (12%) are significantly more likely to say they have no concerns than non- 
parents/carers (8%). Furthermore, those aged 18-34 (15%) are significantly more likely to say 
they have no concerns than 35-54 year olds (8%) and 55+ year olds (6%). 
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When prompted, the data protection concern of most importance to the public is “personal 
information being used for scams or fraud”, ranked first of nine options by 29% and in the top three 
by 60% (vs. 31% and 65% respectively in 2020). 


e This is followed by “personal information being stolen”, ranked first by a fifth (21%) and 57% 
ranking it in the top three. 

e The least important data concern is “my personal information being shared for medical 
reasons”, ranked first by 3% and in the top three by 13%. 


Q14aii. Please rank the following data protection concerns in order of their importance to you. 
2020 2021 


1% Choice _NET: Top 3 1* Choice | NET: Top 3 


My personal information being used for scams 
lor fraud 31% 65% 29% 60% 


My personal information being stolen 26% 64% 21% 57% 


Children's personal information being used 
online 8% 26% 10% 26% 


My personal information being collected or used 
without my knowledge N/A N/A 10% 35% 


My personal information being shared without a 
valid reason 9% 36% 6% 26% 


My personal information being used in an 
automated way to make decisions about me 5% 24% 5% 18% 


Inaccurate information being held about me by 
companies/organisations 5% 21% 5% 18% 


Use of surveillance, for example, facial 
recognition 6% 20% 4% 15% 


My personal information being used to target 
me with online advertising 6% 19% 4% 16% 


The ability for companies/organisations to 
access personal information held about me 5% 24% 3% 18% 


My personal information being shared for 
medical reasons N/A N/A 3% 13% 
Base: All Adults: 2020 (2150) / 2021 (2102) 


e Non-parents/carers are significantly more likely to rank “My personal information being 
used for scams or fraud” or “My personal information being stolen” as most important to 
them than parents/carers. 

e Additionally, those aged 55+ are significantly more likely to rank “My personal information 
being used for scams or fraud” or “My personal information being stolen” as most important 
to them than those aged 18-34 or 35-54. 
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Having personal information used for scams/fraud (81%) or stolen (79%) are events that would be 
most likely to prevent the public from using an organisation. 


Q14aiii. Would these concerns stop you from using a company or organisation? 


My personal information being used for scams or fraud 81% 9% |10% 
My personal information being stolen 79% 10% | 12% 
My personal information being collected or used without my E 10% 17% 
knowledge 
My personal information being shared without a valid reason TEYA 11% 16% 
Children's personal information being used online 65% 16% 18% 


Inaccurate information being held about me by 
companies/organisations 


63% 14% PEY 


My personal information being used in an automated way to make 
decisions about me 


57% 16% 27% 


The ability for companies/organisations to access personal 
information held about me 


EEY 15% 29% 


My personal information being used to target me with online 


52% PEY 26% 


advertising 
Use of surveillance, for example, facial recognition 50% 23% 27% 
My personal information being shared for medical reasons 40% 30% 30% 
mYes MNo Eit Depends 
NB: This question was not asked in this way in 2020 Base: All Adults: (2102) 


e With the exception of “My personal information being used to target me with online 
advertising”, “My personal information being shared for medical reasons”, “Use of 
surveillance, for example, facial recognition” and “The ability for companies/organisations to 
access personal information held about me”, females are significantly more likely than males 
to say all of these concerns would stop them from using a company or organisation. 

e Non-parents/carers are significantly more likely to say that “My personal information being 
stolen” and “My personal information being used for scams or fraud” would prevent them 
from using a company or organisation than parents/carers. 

e Those aged 55+ are significantly more likely than 18-34 year olds to say that all of the concerns 
would prevent them from using a company or organisation. With the exception of “My 
personal information being shared for medical reasons”, “Use of surveillance, for example, 
facial recognition” and “Children’s personal information being used online”, those aged 55+ 
are also significantly more likely than 35-54 year olds to say all of these concerns would stop 
them from using a company or organisation. 
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E.3.2 Freedom of Information Act (FOIA) 


The awareness of rights that the public feels it has to access information held by the Government, 
public authorities and/or publicly owned companies remains in line with the awareness of this in 2020, 
with no significant shifts. 


Q17. What rights under law do you think you have to access information held by the Government, 


public authorities and/or publicly owned companies and organisations in the UK? 


The right to request information held by public — 49% 
organisations 49% 


The right to know what type of information is available 
from public organisations 


44% 
44% 


The right to see what public money is being spent on 
The right to see official information from public OoOo ë 
organisations such as minutes and planning documents 39% 
The right to request information about the SSS 34% 
environment 34% 
i 25% 


. i ; 3% 
The public don't have any rights 3% 


44% 


m2020 m2021 


Base: All Adults: 2020 (2150) / 2021 (2102) 


e Females (46%) are significantly more likely to be aware of “the right to see what public money 
is being spent on” than males (42%). 

e Non-parents/carers are significantly more likely than parents/carers to be aware of “the right 
to request information held by public organisations”, “the right to know what type of 
information is available from public organisations”, and “the right to see official information 
from public organisations such as minutes and planning documents”. 

e BAME respondents (52%) are significantly more likely to be aware of “the right to see what 
public money is being spent on” than non-BAME respondents (43%), while non-BAME 
respondents are significantly more likely to claim they “don’t know” about any of the rights 
than BAME respondents (28% vs. 19% respectively). 

e With the exception of “the right to request information about the environment”, those aged 
55+ are significantly more likely than 18-34 or 35-54 year olds to know about all rights. 
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The proportion of the public that claims to have exercised each FOIA right is relatively low. Many 
who haven’t would like to do so in the future but are often unsure how to. 


e “Seeing official information from public organisations such as minutes and planning” is the 
FOIA right with the highest proportion of the public already having done (18%). 

e Around a third (between 30%-37%) would like to exercise each right and feel they know 
how to. The right to “know what type of information is available from public organisations” 
and to “see what public money is being spent on” (37% and 35% respectively) are the FOIA 
rights with the highest future interest and knowledge how to do so. 

e Between 24%-35% would like to exercise each right but feel they don’t know how to. 


Q17a. Which of the following best describes you for each of the following rights? 


2020 2021 


Already Would | Would Not Already Would | Would Not 


done liketodo liketo interested) done liketodo/ liketo interested 
this thisand butdon’t inthis this | thisand |butdon’t in this 
know know know know 
howto | howto how to | howto 


The right to see official 
information from 
public organisations 
Such as minutes and 
planning 20% 30% 25% 24% 18% 30% 24% 27% 
The right to see what 
public money is being 
spent on 14% 36% 32% 18% 12% 35% 35% 19% 


The right to request 
information held by 
public organisations 12% 32% 35% 22% 10% 34% 32% 24% 


The right to know what 
type of information is 
available from public 
organisations 10% 36% 36% 19% 10% 37% 35% 19% 


The right to request 

information about the 

environment 9% 35% 31% 25% 10% 34% 35% 22% 
Base: All Adults mentioning any rights: 2020 (between 740 - 1059) / 2021 (between 714 - 1025). 


e With the exception of “the right to see official information from public organisations such as 
minutes and planning”, 18-34 year olds are significantly more likely to have already 
exercised FOIA rights than 35+ year olds. 
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e With the exception of “the right to see official information from public organisations such as 
minutes and planning”, parents/carers are significantly more likely to have already exercised 
FOIA rights than non-parents/carers. 

e Those in urban areas are significantly more likely to have exercised FOIA rights than those in 
suburban or rural areas. 


46% agree that “Information | want about Government, public authorities and/or publicly owned 
companies is available and accessible”, while 42% agree that “The right of access to information has 
increased my trust and confidence in public bodies”, both similar proportions to 2020 (47% and 45% 
respectively). 
e There has been a significant shift towards the middle for “The right of access to information 
has increased my trust and confidence in public bodies”, with 46% saying they neither agree 
nor disagree with this (vs. 43% in 2020). 


Q18. Do you agree or disagree with the following statements? 
2020 


Net Neither | Net Net Neither Net 


Agree Disagree Agree Disagree 


Information | want about Government, 
public authorities and/or publicly owned | 47% 41% 12% 46% 43% 11% 
companies is available and accessible 


The right of access to information has 

increased my trust and confidence in 

public bodies 45% 43% 12% 42% 46% 12% 
Base: All Adults: 2020 (2150) / 2021 (2102) 


e Males (50%) are significantly more likely to agree that “Information | want about Government, 
public authorities and/or publicly owned companies is available and accessible” than females 
(42%). 

e Parents/carers are significantly more likely to agree with these statements (53% and 51% 
respectively) than non-parents/carers (42% and 38%). 

e BAME respondents are significantly more likely to agree with these statements (57% and 54% 
respectively) than non-BAME respondents (44% and 41%). 

e 18-34 year olds are significantly more likely to agree with these statements than 35+ year olds. 

e Those living in urban areas are significantly more likely to agree with these statements than 
those living in suburban or rural areas. 
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E.4 Perceptions towards the exchange of information 


E.4.1 Perceptions towards the exchange of personal information 


The public is often willing to undertake online activity that risks compromising their personal 
information. Opinion is split on willingness to trade-off personal information online for something in 
return, free access to websites or the ability to purchase products and services they want. A majority 
are against contact from companies they haven’t dealt with before if the information has been 
sourced from either publicly available information or between partner companies. 


e Over half (53%) of the public state they agree that “when prompted, they will agree to 
accept cookies from a website without looking at the details”, and nearly half (48%) agree 
that “they are comfortable accessing online banking on their mobile while away from 
home”. 

e Over two in five (43%) agree that they are willing to share their personal information freely if 
they feel there is a benefit in doing so, and the proportion disagreeing with this has 
significantly fallen since 2020, from 25% to 21%. 

e Opinion is split in terms of “not minding seeing advertisements targeted to me if | can use 
websites free of charge” and being “more important to them to purchase and use products 
and services than what organisations do with their personal information” (with 38% and 33% 
respectively agreeing, whilst 30% and 29% disagree). 

e The lowest agreement levels are shown in response to companies and/or organisations 
sharing information, with one in five (20%) agreeing that “they are fine with a company 
contacting them that they haven't dealt with before, if their details have been sold between 
partner organisations”. 58% disagree with this statement. 

o The proportion disagreeing that “they are fine with a company contacting them that 
they haven’t dealt with before, if they are getting details from publicly available 
information” is 46%, although this is significantly down from 52% in 2020. 
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Q19. How much do you agree or disagree with the following statements...? 


2020 2021 


Net Neither | Net | Net | Neither _ Net 


Agree Disagree Agree _ Disagree 


When prompted, | will agree to accept cookies 
from a website without looking at the details 
they give me 55% 26% 19% 53% 27% 20% 


| am comfortable with my personal information 
being shared if it is for medical reasons N/A N/A N/A 50% 31% 19% 


| am comfortable accessing online banking on 
my mobile while away from my home 48% 19% 32% 48% 22% 30% 


| am willing to share my personal information 
freely if | feel there is a benefit for me 43% 32% 25% 43% 36% 21% 


| don't mind seeing advertisements targeted to 
me if | can use websites free of charge 38% 30% 32% 38% 32% 30% 


It is more important to me to purchase and use 
products and services than what organisations 
do with my personal information 35% 36% 29% 33% 38% 29% 


| am fine with a company contacting me that | 
haven't dealt with before, if they are getting my 
details from publicly available information 24% 24% 52% 26% 28% 46% 


| am fine with a company contacting me that | 

haven't dealt with before, if my details have 

been sold between partner organisations 20% 20% 60% 20% 22% 58% 
Base: All Adults: 2020 (2150) / 2021 (2102) 


e With the exception of “When prompted, | will agree to accept cookies from a website without 
looking at the details they give me”, “I am comfortable with my personal information being 
shared for medical reasons”, and “I am comfortable accessing online banking on my mobile 
while away from home”, males are significantly more likely to agree with all statements than 
females. 

e Parents/carers are significantly more likely to agree with all statements than non- 
parents/carers, with the exception of “I am comfortable with my personal information being 
shared if it is for medical reasons.” 

e With the exception of “When prompted, | will agree to accept cookies from a website without 
looking at the details they give me”, those living in urban areas are significantly more likely to 
agree to all statements than those living in suburban or rural areas. 
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The majority of the public feel that there would be no difference in their behaviour in terms of 
exchanging personal information with organisations/companies as a direct result of the Covid-19 
pandemic. However, more people say they are “less likely” than “more likely” across the statements. 


With the Covid-19 pandemic now into its second year and the public more used to different ways of 
doing things than a year ago, there has been a shift to the middle ground, with the proportion saying 
“no difference” higher for all statements. 


e “Be comfortable accessing online banking on my mobile while away from home” is the activity 
with the highest proportion of “more likely” (15%). It is the only activity with at least the same 
proportion of “more likely” as in 2020. 


Q20. As a direct result of the Covid-19 pandemic, are you more or less likely to do the following, or 
has it not made a difference? 


2020 2021 


No 
_ difference 


| More likely | Less likely No More likely | Less likely 
difference 


Be comfortable accessing online 
banking on my mobile while 
outside my home 15% 23% 62% 15% 20% 65% 


Share my personal information 
freely if | feel there is a benefit for 
me 15% 23% 61% 14% 21% 65% 


When prompted, agree to accept 
cookies from a website without 
looking at the details they give me 15% 22% 63% 13% 23% 64% 


Use websites where 
advertisements are targeted to 
me if | can use them free of charge 15% 23% 62% 12% 20% 66% 


Receive contact from a company | 
have not dealt with previously as 
long as they are getting my details 
from publicly available 
information 13% 28% 59% 10% 25% 66% 


Purchase and use products and 
services regardless of what 
organisations do with my personal 
information 12% 28% 59% 10% 26% 65% 


Receive contact from a company | 

have not dealt with previously if 

my details have been sold 

between partner organisations 12% 31% 57% 10% 31% 60% 
Base: All Adults: 2020 (2150) / 2021 (rebased to not include new “unsure” code — ranging from 1943 — 1979) 
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E.4.2 Perceptions towards the exchange of health related information 


Half (50%) are comfortable with their personal information being shared if it is for medical reasons, 
while one in five (19%) would not be comfortable with this. 


Q19. How much do you agree or disagree with the following statements...? 


“I am comfortable with my personal information being shared if it is for medical reasons” 


= NET Agree m Neither # NET Disagree 


NB: This question was not asked in 2020 Base: All Adults: (2102) 


e Non-parents/carers (21%) are significantly more likely to disagree that they are comfortable 
with their personal information being shared if it is for medical reasons than parents/carers 
(17%). 

e = Those living in urban areas (59%) are significantly more likely to agree that they are 
comfortable with their personal information being shared if it is for medical reasons than 
those living in suburban (45%) or rural (50%) areas. 
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Nearly 6 in 10 feel that there is no difference in their comfort with their personal information being 
shared with public or private sector companies/organisations for medical reasons or if it will lead to 
tailored health insurance or other similar products as a result of the Covid-19 pandemic. However, 
more people say they are “less likely” than “more likely” to feel comfortable with this exchange of 
information for medical reasons. 


Q20. As a direct result of the Covid-19 pandemic, are you more or less likely to do the following, or 
has it not made a difference? 


2021 


More likely | Less likely | No difference 


Be comfortable with my personal 
information being shared 
amongst public sector 
organisations (e.g. universities 
and national advisory bodies) if it 
is for medical reasons 15% 20% 57% 7% 


Be comfortable with my personal 
information being shared with 
private sector companies (e.g. 
pharmaceutical companies) if it is 
for medical reasons 14% 22% 58% 6% 


Be comfortable with my personal 
information being shared with 
private sector companies (e.g. 
health insurance companies) if it 
will lead to tailored health 
insurance or other similar 
products 

10% 24% 58% 8% 


NB: This question was not asked in 2020 Base: All Adults: (2102) 


e Parents/carers are more likely to feel strongly about their comfort with personal information 
being shared for medical reasons, being both significantly more likely and less likely to feel 
comfortable with all statements as a direct result of the Covid-19 pandemic than non- 
parents/carers. 

e Those aged 18-34 are significantly more likely to feel more comfortable with all statements as 
a direct result of the Covid-19 pandemic than those aged 35+. 

e Those living in urban areas are significantly more likely to feel comfortable with all statements 
than those living in suburban or rural areas. 

e BAME respondents are significantly less likely to feel comfortable with all statements as a 
direct result of the Covid-19 pandemic than non-BAME respondents. 
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Just under half (47%) have downloaded the NHS Covid-19 app, Protect Scotland app or STOP Covid NI 


app in the past 12 months. 


e Respondents are more likely to claim they have received suspicious communications from 
people claiming to be from the official contact tracing service (37%) than they have received 


communications from the official contact tracing service (31%). 


Q20a. In the last 12 months, have you...? 


Received suspicious communications (phone call, email 
or text message) from people claiming to be from the 37% 63% 
official contact tracing service 


Received a Covid-related phone call, email or text 
message from the official contact tracing service 


31% 69% 


Downloaded the NHS Covid-19 app, Protect Scotland 6 2 
app or STOP Covid NI app 47% 53% 


Yes MNo 


NB: This question was not asked in 2020 Base: All Adults: (2102) 


Males (40%) are significantly more likely to have received suspicious communications from 
people claiming to be from the official contact tracing service than females (34%). 
Parents/carers are significantly more likely to answer ‘yes’ to all statements than those who 
aren’t parents/carers. 

Those aged 18-34 are significantly more likely to answer ‘yes’ to all statements than those 
aged 35-54 or 55+. 

Those living in urban areas are significantly more likely to answer ‘yes’ to all statements than 
those living in suburban or rural areas. 

BAME respondents are significantly more likely to have received communication from the 
official contact tracing service (40%) and significantly more likely to have received suspicious 
communications from people claiming to be from the official contact tracing service (49%) 
than non-BAME respondents (30% and 35% respectively). 
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Just under half (47%) are comfortable with the NHS sharing their health data with public sector 
companies as long as it will aim to lead to improved treatments for viruses/illnesses, while a lower 
proportion (42%) would be comfortable with the NHS sharing their data with private sector 
companies for the same reasons. 


Q20ab. How comfortable or uncomfortable are you with the NHS sharing your health data with each 
of the following...? 


With other public sector companies or 47% 30% 23% 
organisations (e.g. universities or national 
advisory bodies), as long as it will aim to lead to 
improved treatments for viruses/illnesses. 


With private sector companies or organisations 42% 30% 28% 
(e.g. Pharmaceutical Companies), as long as it will 
aim to lead to improved treatments for 
Viruses/illnesses. 


NB: This question was not asked in 2020 Base: All Adults: (2102) 


e  Parents/carers are significantly more likely to be comfortable with the NHS sharing their 
health data with other public sector companies (54%) and private sector companies (53%) as 
long as it will lead to improved treatments for viruses/illnesses than those who are not 
parents/carers (44% and 37% respectively). 

e BAME respondents are significantly more likely to be comfortable with the NHS sharing their 
health data with public sector companies (55%) and private sector companies (54%) as long 
as it will lead to improved treatments for viruses/illnesses than non-BAME respondents (47% 
and 40% respectively). 

e Those living in urban areas are significantly more likely to be comfortable with the NHS 
sharing their health data with public sector companies (54%) and private sector companies 
(51%) as long as it will aim to lead to improved treatments than those in suburban (47% and 
40% respectively) and rural areas (42% and 36% respectively). 

e Those aged 55+ are significantly more likely to not be comfortable with the NHS sharing 
their health data with both public sector companies (29%) and private sector companies 
(35%) than those aged 35-54 (23% and 30% respectively) and 18-34 (13% and 17% 
respectively). 
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